@onesi/genesis-cli 0.2.13 → 0.2.15

package/README.md

@@ -3,7 +3,7 @@
 `genesis`, the OneOS command line. It works against the Genesis API at `https://os.one.ml/api`.
 
 ```sh
-npx -y @onesi/genesis-cli@0.2.13 --help
+npx -y @onesi/genesis-cli@0.2.15 --help
 ```
 
 ## First run

package/dist/agents.d.ts

@@ -0,0 +1,13 @@
+import type { Command } from 'commander';
+import { type Genesis } from '@onesi/genesis';
+type Dependencies = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    signal?: AbortSignal;
+};
+/**
+ * `genesis agents search <q...>` and `genesis agents sitemap`: public agent search (Live agents their owners made
+ * public). No login is needed; no credential is sent and nothing is metered.
+ */
+export declare function registerAgents(program: Command, deps: Dependencies): void;
+export {};

package/dist/agents.js

@@ -0,0 +1,41 @@
+import { AGENT_SEARCH_LIMIT_MAX, AGENT_SEARCH_Q_MAX } from '@onesi/genesis';
+import { c, safe, table } from './output.js';
+/** One hit as the terminal prints it; every server-provided field goes through safe(). */
+function hitLines(hit) {
+    const head = `${c.bold(safe(hit.name ?? hit.agentId))}  ${c.dim(safe(hit.agentId))}${hit.owner ? `  ${safe(hit.owner.name)}` : ''}`;
+    const lines = [head, `  ${c.dim(safe(hit.did))}`];
+    if (hit.description)
+        lines.push(`  ${safe(hit.description)}`);
+    if (hit.createdAt)
+        lines.push(`  ${c.dim(`created ${new Date(hit.createdAt).toISOString().slice(0, 10)}`)}`);
+    return lines.join('\n');
+}
+/**
+ * `genesis agents search <q...>` and `genesis agents sitemap`: public agent search (Live agents their owners made
+ * public). No login is needed; no credential is sent and nothing is metered.
+ */
+export function registerAgents(program, deps) {
+    const agents = program.command('agents').description('Public agent search: Live agents their owners made public (no login needed, never metered)');
+    agents.command('search <q...>')
+        .description(`Search public agents (GET /v1/agents/search); the words are joined into one query of 1 to ${AGENT_SEARCH_Q_MAX} characters`)
+        .option('--limit <n>', `most results, 1 to ${AGENT_SEARCH_LIMIT_MAX} (default ${AGENT_SEARCH_LIMIT_MAX})`)
+        .action(async (words, o) => {
+        const q = words.join(' ');
+        if (q.trim() === '' || q.length > AGENT_SEARCH_Q_MAX)
+            throw new Error(`The query must be 1 to ${AGENT_SEARCH_Q_MAX} characters.`);
+        let limit;
+        if (o.limit !== undefined) {
+            if (!/^[0-9]{1,2}$/.test(o.limit) || Number(o.limit) < 1 || Number(o.limit) > AGENT_SEARCH_LIMIT_MAX)
+                throw new Error(`--limit must be an integer from 1 to ${AGENT_SEARCH_LIMIT_MAX}.`);
+            limit = Number(o.limit);
+        }
+        const result = await (await deps.client()).agents.search(q, { ...(limit === undefined ? {} : { limit }), ...(deps.signal ? { signal: deps.signal } : {}) });
+        deps.emit(result, () => result.results.length ? result.results.map(hitLines).join('\n\n') : c.dim('(no public agents match)'));
+    });
+    agents.command('sitemap')
+        .description('Every public agent id with when it last changed (GET /v1/agents/sitemap)')
+        .action(async () => {
+        const result = await (await deps.client()).agents.sitemap(deps.signal ? { signal: deps.signal } : {});
+        deps.emit(result, () => table(result.agents.map(a => ({ agentId: a.agentId, updatedAt: new Date(a.updatedAt).toISOString() })), ['agentId', 'updatedAt']));
+    });
+}

package/dist/dials.js

@@ -27,6 +27,34 @@ export function registerDials(program, dependencies) {
             throw new Error('Unsupported Dials search filter. Scope is selected by the command context.');
         emit(await client.dials.numbers.search(scope, { ...filters, ...(options.areaCode ? { areaCode: options.areaCode } : {}) }));
     });
+    numbers.command('voice-handler').requiredOption('--number <id>', 'Owned SignalWire number ID').requiredOption('--handler <name>', 'one_phone (the One phone line) or default')
+        .action(async (options) => {
+        if (options.handler !== 'one_phone' && options.handler !== 'default')
+            throw new Error('--handler must be one_phone or default.');
+        const { client, scope } = await context();
+        emit(await client.dials.numbers.setVoiceHandler({ scope, phoneNumberId: options.number, handler: options.handler }));
+    });
+    // A person's own One number: the person's own token, no Dials scope (Dials keys it to the verified person).
+    const oneNumbers = dials.command('one-numbers').description('The phone number of your own One (signed in as yourself)');
+    oneNumbers.command('mine', { isDefault: true }).action(async () => { const client = await dependencies.client(); emit(await client.dials.oneNumbers.mine()); });
+    oneNumbers.command('suggestions').option('--area-code <code>', 'three digit area code').option('--text <text>', 'search text')
+        .option('--lat <n>', 'latitude (with --lng, from the device after permission)').option('--lng <n>', 'longitude (with --lat)')
+        .action(async (options) => {
+        const client = await dependencies.client();
+        const num = (value, name) => { if (value === undefined)
+            return undefined; const n = Number(value); if (!Number.isFinite(n))
+            throw new Error(`${name} must be a number.`); return n; };
+        if ((options.lat === undefined) !== (options.lng === undefined))
+            throw new Error('--lat and --lng go together.');
+        // Coordinates travel in the JSON body, never the URL.
+        const body = { ...(options.areaCode !== undefined ? { areaCode: options.areaCode } : {}), ...(options.text !== undefined ? { text: options.text } : {}),
+            ...(options.lat !== undefined ? { lat: num(options.lat, '--lat') } : {}), ...(options.lng !== undefined ? { lng: num(options.lng, '--lng') } : {}) };
+        emit(await client.dials.oneNumbers.suggestions(body));
+    });
+    oneNumbers.command('choose').requiredOption('--e164 <number>', 'a number from the suggestions, for example +15555550123').requiredOption('--idempotency-key <key>', 'reuse it to retry the same choice')
+        .action(async (options) => { const client = await dependencies.client(); emit(await client.dials.oneNumbers.choose({ e164: options.e164, idempotencyKey: options.idempotencyKey })); });
+    oneNumbers.command('release').requiredOption('--yes', 'confirm: the number is released at the carrier and cannot be recovered')
+        .action(async () => { const client = await dependencies.client(); emit(await client.dials.oneNumbers.release()); });
     numbers.command('reconciliations').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.reconciliations(scope)); });
     numbers.command('drift').action(async () => { const { client, scope } = await context(); emit(await client.dials.numbers.drift(scope)); });
     dials.command('overview').action(async () => { const { client, scope } = await context(); emit(await client.dials.overview.summary(scope)); });
@@ -76,6 +104,8 @@ export function registerDials(program, dependencies) {
     workflows.command('list', { isDefault: true }).action(async () => { const { client, scope } = await context(); emit(await client.dials.workflows.list(scope)); });
     workflows.command('deploy').requiredOption('--body <json-or-@file>', 'Workflow graph and actorId')
         .action(async (options) => { const { client, scope } = await context(); const body = await readBody(options.body); emit(await client.call('dials_deployWorkflow', { body: { ...body, scope } })); });
+    workflows.command('delete').requiredOption('--workflow <id>', 'Owned workflow ID; deletes it and its routing descriptor (409 while a held number is assigned)')
+        .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.workflows.delete(options.workflow, { scope })); });
     numbers.command('delete').requiredOption('--number <id>', 'Owned number ID to release at the carrier').requiredOption('--actor <id>', 'Actual actorId').option('--reason <text>', 'Release reason').option('--platform <id>', 'Selected data platform; omitted defaults to dials')
         .action(async (options) => { const { client, scope } = await context(); emit(await client.dials.numbers.delete({ ...scope, ...(options.platform !== undefined ? { platformId: options.platform } : {}), number_id: options.number, actorId: options.actor, ...(options.reason !== undefined ? { reason: options.reason } : {}) })); });
     const calls = dials.command('calls').description('Call activity and approved outbound calls');

package/dist/fleets.d.ts

@@ -3,4 +3,4 @@ import type { Genesis } from '@onesi/genesis';
 /** Read one key from stdin (at most 4096 bytes, one trailing newline dropped); `label` names it in errors. */
 export declare function readStdinKey(label: string, input?: AsyncIterable<Uint8Array>): Promise<string>;
 export declare const readFoundryKey: (input?: AsyncIterable<Uint8Array>) => Promise<string>;
-export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>, computerKeyInput?: () => Promise<string>): void;
+export declare function registerFleets(program: Command, client: () => Promise<Genesis>, emit: (data: unknown) => void, keyInput?: () => Promise<string>, computerKeyInput?: () => Promise<string>, webKeyInput?: () => Promise<string>): void;

package/dist/fleets.js

@@ -22,6 +22,7 @@ export async function readStdinKey(label, input = process.stdin) {
 }
 export const readFoundryKey = (input = process.stdin) => readStdinKey('Foundry key', input);
 const readComputerKey = () => readStdinKey('Computer key');
+const readWebKey = () => readStdinKey('Web key');
 const SEAT_TYPES = ['helper', 'operator', 'always_on'];
 const seatType = (value) => {
     if (!SEAT_TYPES.includes(value))
@@ -30,7 +31,7 @@ const seatType = (value) => {
 };
 /** Whole-number flags go to the SDK as numbers; it refuses anything that is not a whole number before sending. */
 const count = (value) => /^\d+$/.test(value) ? Number(value) : NaN;
-export function registerFleets(program, client, emit, keyInput = readFoundryKey, computerKeyInput = readComputerKey) {
+export function registerFleets(program, client, emit, keyInput = readFoundryKey, computerKeyInput = readComputerKey, webKeyInput = readWebKey) {
     const fleets = program.command('fleets').description('Fleets: managed Henry instances and tasks');
     const agents = fleets.command('agents').description('Persistent Henry agents on Fleets-managed compute');
     agents.command('list').action(async () => emit(await (await client()).fleets.agents.list()));
@@ -175,6 +176,11 @@ export function registerFleets(program, client, emit, keyInput = readFoundryKey,
     computer.command('set').description('Read the key from stdin and encrypt it with Genesis KMS (never returned)')
         .action(async () => emit(await (await client()).fleets.computerConnection.set(await computerKeyInput())));
     computer.command('delete').action(async () => emit(await (await client()).fleets.computerConnection.delete()));
+    const web = fleets.command('web-connection').description('Key (scopes exactly traces:read) seat research tasks use to search and read the web through Traces');
+    web.command('get').action(async () => emit(await (await client()).fleets.webConnection.get()));
+    web.command('set').description('Read the key from stdin and encrypt it with Genesis KMS (never returned)')
+        .action(async () => emit(await (await client()).fleets.webConnection.set(await webKeyInput())));
+    web.command('delete').action(async () => emit(await (await client()).fleets.webConnection.delete()));
     const usage = fleets.command('usage').description('Usage observations derived from your tasks');
     usage.command('events').description('List task lifecycle and execution-time usage events').option('--limit <n>').option('--before <task_id>')
         .action(async (options) => emit(await (await client()).fleets.usage.events({ ...(options.limit ? { limit: Number(options.limit) } : {}), ...(options.before ? { before: options.before } : {}) })));

package/dist/function-input.d.ts

@@ -1,3 +1,8 @@
-export declare function readFunctionFile(path: string, limit: number): Promise<Uint8Array>;
-export declare function readFunctionJson(path: string, limit: number): Promise<Record<string, unknown>>;
+/** `-` as the path means standard input: the bytes are read from a pipe or redirect (never from a terminal) and never touch disk. */
+export declare const STDIN_PATH = "-";
+export declare function readFunctionStdin(limit: number, input?: AsyncIterable<Uint8Array | string> & {
+    isTTY?: boolean;
+}): Promise<Uint8Array>;
+export declare function readFunctionFile(path: string, limit: number, stdin?: Parameters<typeof readFunctionStdin>[1]): Promise<Uint8Array>;
+export declare function readFunctionJson(path: string, limit: number, stdin?: Parameters<typeof readFunctionStdin>[1]): Promise<Record<string, unknown>>;
 export declare function writeFunctionOutput(path: string, bytes: Uint8Array): Promise<void>;

package/dist/function-input.js

@@ -1,5 +1,29 @@
 import { open, writeFile } from 'node:fs/promises';
-export async function readFunctionFile(path, limit) {
+/** `-` as the path means standard input: the bytes are read from a pipe or redirect (never from a terminal) and never touch disk. */
+export const STDIN_PATH = '-';
+export async function readFunctionStdin(limit, input = process.stdin) {
+    if (input.isTTY)
+        throw new Error('Standard input is a terminal. Pipe the request body into the command, for example: echo \'{}\' | genesis ... --body-file -');
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of input) {
+        const bytes = typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk;
+        size += bytes.length;
+        if (size > limit)
+            throw new Error('Function input on standard input exceeds the documented size limit.');
+        chunks.push(bytes);
+    }
+    const out = new Uint8Array(size);
+    let at = 0;
+    for (const c of chunks) {
+        out.set(c, at);
+        at += c.length;
+    }
+    return out;
+}
+export async function readFunctionFile(path, limit, stdin) {
+    if (path === STDIN_PATH)
+        return readFunctionStdin(limit, stdin);
     let file;
     try {
         file = await open(path, 'r');
@@ -27,8 +51,8 @@ export async function readFunctionFile(path, limit) {
         await file.close();
     }
 }
-export async function readFunctionJson(path, limit) {
-    const bytes = await readFunctionFile(path, limit);
+export async function readFunctionJson(path, limit, stdin) {
+    const bytes = await readFunctionFile(path, limit, stdin);
     try {
         const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
         if (!value || typeof value !== 'object' || Array.isArray(value))

package/dist/hives-operations.js

@@ -1,5 +1,6 @@
 import { registerHivesResources } from './hives-resources.js';
 import { registerHivesPlatform } from './hives-platform.js';
+import { registerHivesTimers } from './hives-timers.js';
 import { Option } from 'commander';
 import { readFunctionJson } from './function-input.js';
 function metricsOptions(command) {
@@ -20,6 +21,7 @@ const pagination = (o) => ({ page: integer(o.page, '--page', 10000), per_page: i
 export function registerHivesOperations(hives, deps) {
     registerHivesResources(hives, deps);
     registerHivesPlatform(hives, { client: deps.client, emit: deps.emit, line: deps.line });
+    registerHivesTimers(hives, deps);
     const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
     const read = deps.readRequest ?? readFunctionJson;
     const settings = hives.command('settings').description('Stored project preferences and actual engine capabilities');
@@ -32,8 +34,8 @@ export function registerHivesOperations(hives, deps) {
     crons.command('create <project_id>').requiredOption('--request-file <path>', 'JSON name, schedule, handler, timezone and enabled preference')
         .action(async (project, o) => {
         const body = await read(o.requestFile, 64 * 1024);
-        if (typeof body.name !== 'string' || typeof body.schedule !== 'string' || typeof body.handler !== 'string')
-            throw new Error('Cron JSON requires name, schedule and handler strings.');
+        if (typeof body.name !== 'string' || typeof body.schedule !== 'string' || (typeof body.handler !== 'string' && !(body.handler && typeof body.handler === 'object' && body.handler.type === 'callback')))
+            throw new Error('Cron JSON requires name and schedule strings and a handler: a function id string or {"type":"callback","target_id":"tgt_…","payload":{…}}.');
         output(await (await deps.client()).hives.crons.create(project, { ...body, name: body.name, schedule: body.schedule, handler: body.handler }));
     });
     crons.command('update <project_id> <cron_id>').requiredOption('--request-file <path>', 'JSON schedule patch')

package/dist/hives-project.js

@@ -11,6 +11,10 @@ export const HIVES_PROJECT_COMMANDS = {
     'settings update': 'hives_update_project_settings',
     'crons list': 'hives_list_crons',
     'crons create': 'hives_create_cron',
+    'timers list': 'hives_listTimers',
+    'timers create': 'hives_createTimer',
+    'timers targets list': 'hives_listTimerTargets',
+    'timers targets create': 'hives_createTimerTarget',
     'metrics project': 'hives_get_project_metrics',
     'metrics requests': 'hives_get_request_metrics',
     'metrics latency': 'hives_get_latency_metrics',

package/dist/hives-timers.d.ts

@@ -0,0 +1,10 @@
+import { Command } from 'commander';
+import type { Genesis } from '@onesi/genesis';
+type Deps = {
+    client: () => Promise<Genesis>;
+    emit: (data: unknown, pretty: () => string) => void;
+    readRequest?: (path: string, limit: number) => Promise<Record<string, unknown>>;
+    line?: (text: string) => void;
+};
+export declare function registerHivesTimers(hives: Command, deps: Deps): void;
+export {};

package/dist/hives-timers.js

@@ -0,0 +1,112 @@
+import { open, unlink } from 'node:fs/promises';
+import { Option } from 'commander';
+import { readFunctionJson } from './function-input.js';
+const STATES = ['scheduled', 'firing', 'fired', 'failed', 'cancelled'];
+const SECRET_NOTE = 'The signing secret is shown once. Choose --print-secret-only (stdout is the secret and nothing else, e.g. `| gcloud secrets create NAME --data-file=-`) or --secret-file <path> (new file, mode 0600). The CLI never prints it any other way.';
+/** Where the one-time signing secret goes. Exactly one sink must be chosen before anything is sent. */
+async function secretSink(o, line) {
+    if (Boolean(o.printSecretOnly) === Boolean(o.secretFile))
+        throw new Error(`Choose exactly one of --print-secret-only or --secret-file. ${SECRET_NOTE}`);
+    if (o.printSecretOnly)
+        return { print: true, file: undefined, path: undefined, line };
+    // Create the file first (wx: never overwrite) so a bad path fails BEFORE Hives mints a secret that nothing could keep.
+    let file;
+    try {
+        file = await open(o.secretFile, 'wx', 0o600);
+    }
+    catch {
+        throw new Error('Could not create the secret file. It must be a new file in a writable directory.');
+    }
+    return { print: false, file, path: o.secretFile, line };
+}
+/** Close the sink's file and remove it: nothing was written, and an empty file would block a retry with the same path. */
+async function discardSink(sink) {
+    if (!sink.file)
+        return;
+    await sink.file.close().catch(() => undefined);
+    await unlink(sink.path).catch(() => undefined);
+}
+/** The signing secret leaves the answer here and goes to exactly one place. Returns the answer without it. */
+async function deliverSecret(sink, answer) {
+    const { signing_secret: secret, ...rest } = (answer ?? {});
+    if (typeof secret !== 'string' || !secret) {
+        await discardSink(sink);
+        throw new Error('Hives answered without a signing secret, so none was written. Nothing was echoed.');
+    }
+    if (sink.print) {
+        sink.line(secret);
+        return undefined;
+    }
+    try {
+        await sink.file.writeFile(secret + '\n');
+    }
+    catch (e) {
+        await discardSink(sink);
+        throw e;
+    }
+    await sink.file.close();
+    return { ...rest, signing_secret: `[written to ${sink.path}]` };
+}
+export function registerHivesTimers(hives, deps) {
+    const output = (data) => deps.emit(data, () => JSON.stringify(data, null, 2));
+    const line = deps.line ?? ((text) => process.stdout.write(text + '\n'));
+    const read = deps.readRequest ?? readFunctionJson;
+    const timers = hives.command('timers').description('One-shot timers that fire a signed callback (hives-callback-v1) at a registered target');
+    timers.command('create <project_id>').requiredOption('--request-file <path>', 'JSON {at, target_id, payload, idempotency_key}')
+        .action(async (project, o) => {
+        const body = await read(o.requestFile, 8 * 1024);
+        if (typeof body.at !== 'string' || typeof body.target_id !== 'string' || typeof body.idempotency_key !== 'string')
+            throw new Error('Timer JSON requires at, target_id and idempotency_key strings.');
+        output(await (await deps.client()).hives.timers.create(project, { ...body, at: body.at, target_id: body.target_id, idempotency_key: body.idempotency_key }));
+    });
+    timers.command('get <project_id> <timer_id>').action(async (project, timer) => output(await (await deps.client()).hives.timers.get(project, timer)));
+    timers.command('list <project_id>').option('--idempotency-key <key>').addOption(new Option('--state <state>').choices(STATES))
+        .option('--limit <number>', '1 to 100 (default 50)').option('--cursor <cursor>')
+        .action(async (project, o) => {
+        if (o.limit !== undefined && (!/^\d+$/.test(o.limit) || Number(o.limit) < 1 || Number(o.limit) > 100))
+            throw new Error('--limit must be an integer from 1 to 100.');
+        output(await (await deps.client()).hives.timers.list(project, { idempotency_key: o.idempotencyKey, state: o.state, limit: o.limit === undefined ? undefined : Number(o.limit), cursor: o.cursor }));
+    });
+    timers.command('cancel <project_id> <timer_id>').description('Cancel a scheduled timer (a fired or failed timer is returned unchanged)')
+        .action(async (project, timer) => output(await (await deps.client()).hives.timers.cancel(project, timer)));
+    const targets = timers.command('targets').description('Callback targets and their signing secrets');
+    targets.command('create <project_id>').description(`Register an https callback URL. ${SECRET_NOTE}`)
+        .requiredOption('--url <url>').option('--name <name>')
+        .option('--print-secret-only', 'print ONLY the signing secret (one trailing newline) and nothing else')
+        .option('--secret-file <path>', 'write the signing secret to a new 0600 file; the answer is printed without it')
+        .action(async (project, o) => {
+        const sink = await secretSink(o, line);
+        let answer;
+        try {
+            answer = await (await deps.client()).hives.timers.targets.create(project, { url: o.url, ...(o.name ? { name: o.name } : {}) });
+        }
+        catch (e) {
+            await discardSink(sink);
+            throw e;
+        }
+        const rest = await deliverSecret(sink, answer);
+        if (rest)
+            output(rest);
+    });
+    targets.command('list <project_id>').action(async (project) => output(await (await deps.client()).hives.timers.targets.list(project)));
+    targets.command('get <project_id> <target_id>').action(async (project, target) => output(await (await deps.client()).hives.timers.targets.get(project, target)));
+    targets.command('rotate <project_id> <target_id>').description(`Issue a new signing secret; the old one verifies for 24 hours. ${SECRET_NOTE}`)
+        .option('--print-secret-only', 'print ONLY the new signing secret (one trailing newline) and nothing else')
+        .option('--secret-file <path>', 'write the new signing secret to a new 0600 file; the answer is printed without it')
+        .action(async (project, target, o) => {
+        const sink = await secretSink(o, line);
+        let answer;
+        try {
+            answer = await (await deps.client()).hives.timers.targets.rotate(project, target);
+        }
+        catch (e) {
+            await discardSink(sink);
+            throw e;
+        }
+        const rest = await deliverSecret(sink, answer);
+        if (rest)
+            output(rest);
+    });
+    targets.command('delete <project_id> <target_id>').description('Delete a target (409 target_in_use while a scheduled timer or enabled cron references it)')
+        .action(async (project, target) => output(await (await deps.client()).hives.timers.targets.delete(project, target) ?? { deleted: true, target_id: target }));
+}

package/dist/index.js

@@ -7,6 +7,7 @@ import { registerIamDirectory } from './iam-directory.js';
 import { registerOperationCommands, registerProducts } from './products.js';
 import { registerOrgs } from './orgs.js';
 import { registerConnections } from './connections.js';
+import { registerAgents } from './agents.js';
 import { Command, CommanderError } from 'commander';
 import { Genesis, GenesisError, errorBody, errorCatalog, errorOutcome, isMindsOperation, HivesOperationError, HivesQueueOperationError, MindsAgentError, MindsOwnerError, hivesResponseBytes, MAX_FUNCTION_BODY_BYTES, MAX_FUNCTION_JSON_BYTES, DEFAULT_BASE_URL, requireSecureUrl, redactUserinfo } from '@onesi/genesis';
 import { authConfig, completeLogin, selectSavedContext, savedLoginProvider, startLogin } from './auth.js';
@@ -48,7 +49,7 @@ export function buildProgram(deps = {}) {
     const auth = { ...authConfig(env, f), sleep: deps.sleep };
     const program = new Command('genesis')
         .description('One CLI for every Genesis service.')
-        .version('0.2.13')
+        .version('0.2.15')
         .option('--json', 'machine-readable JSON output')
         .option('--api-key <key>', 'use this API key (default: GENESIS_API_KEY, then your `genesis login`)')
         .option('--base-url <url>', 'gateway URL (default: GENESIS_BASE_URL or https://os.one.ml/api)')
@@ -64,7 +65,7 @@ export function buildProgram(deps = {}) {
         const opts = {
             apiKey: o.apiKey ?? env.GENESIS_API_KEY, token: env.GENESIS_TOKEN,
             baseUrl: o.baseUrl ?? env.GENESIS_BASE_URL, routing: o.direct || env.GENESIS_ROUTING === 'direct' ? 'direct' : 'gateway',
-            fetch: f, userAgent: 'genesis-cli/0.2.13',
+            fetch: f, userAgent: 'genesis-cli/0.2.15',
             credentials: store ? savedLoginProvider(auth, store) : undefined,
         };
         return new Genesis(hivesTransport ? { ...opts, fetch: createHivesNodeTransport(opts, deps.signal) } : opts);
@@ -276,6 +277,7 @@ export function buildProgram(deps = {}) {
     registerProducts(program, { client, emit, signal: deps.signal });
     registerOrgs(program, { client, emit, signal: deps.signal });
     registerConnections(program, { client, emit, signal: deps.signal });
+    registerAgents(program, { client, emit, signal: deps.signal });
     // Agent enrollment sends only the grant's enrollment key (mek_...), never this CLI's login or API key.
     (program.commands.find(c => c.name() === 'iam').commands.find(c => c.name() === 'agents')).command('enroll')
         .description('Enroll an agent under an agent enrollment grant (POST /v1/iam/agents/enroll); the credential secret is shown once')
@@ -286,7 +288,7 @@ export function buildProgram(deps = {}) {
         if (!key)
             throw new Error('Give the enrollment key with --key-file, --key-stdin or GENESIS_ENROLLMENT_KEY; it is never accepted as an argument.');
         const body = await readFunctionJson(o.bodyFile, 16 * 1024);
-        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.13' }).iam.agents.enroll(key, body);
+        const result = await new Genesis({ baseUrl: g().baseUrl ?? env.GENESIS_BASE_URL, fetch: f, userAgent: 'genesis-cli/0.2.15' }).iam.agents.enroll(key, body);
         emit(result, () => JSON.stringify(result, null, 2));
     });
     // ---- auth ------------------------------------------------------------
@@ -838,7 +840,7 @@ export function buildProgram(deps = {}) {
         const url = `${base.href.replace(/\/+$/, '')}/v1/status`;
         let response;
         try {
-            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.13' }, signal: AbortSignal.timeout(15_000) });
+            response = await f(url, { method: 'GET', headers: { accept: 'application/json', 'user-agent': 'genesis-cli/0.2.15' }, signal: AbortSignal.timeout(15_000) });
         }
         catch (e) {
             throw new Error(`Gateway unreachable at ${safe(url)}: ${safe(e.message)}`);

package/dist/minds-owner.js

@@ -1,4 +1,4 @@
-import { readFile, stat } from 'node:fs/promises';
+import { readFunctionJson } from './function-input.js';
 export function registerMindsOwner(minds, client, emit, signal) {
     const intent = (command, revision = true) => {
         command.requiredOption('--operation-id <uuid>', 'retain this non-nil UUID when reconciling the same intent');
@@ -23,19 +23,8 @@ export function registerMindsOwner(minds, client, emit, signal) {
     attachments.command('list <mind_id>').action(async (mind) => emit(await (await client()).minds.attachments.list(mind, { signal })));
     attachments.command('attach <mind_id>').requiredOption('--request-file <path>', 'closed JSON attachment intent with operationId, expectedVersion, subject, permissions and expiresAt')
         .action(async (mind, options) => {
-        const metadata = await stat(options.requestFile);
-        if (!metadata.isFile() || metadata.size > 8192)
-            throw new Error('Attachment request must be at most 8 KiB.');
-        const bytes = await readFile(options.requestFile);
-        if (bytes.length > 8192)
-            throw new Error('Attachment request must be at most 8 KiB.');
-        let request;
-        try {
-            request = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
-        }
-        catch {
-            throw new Error('Attachment request must contain valid JSON.');
-        }
+        // The shared reader: a regular file or "-" for standard input, 8 KiB limit, no content echoed.
+        const request = await readFunctionJson(options.requestFile, 8192);
         emit(await (await client()).minds.attachments.attach(mind, request, { signal }));
     });
     intent(attachments.command('detach <mind_id> <attachment_id>')).action(async (mind, attachment, options) => emit(await (await client()).minds.attachments.detach(mind, attachment, body(options), { signal })));

package/dist/minds.js

@@ -44,6 +44,39 @@ export function registerMinds(program, client, emit, agentClient = client, signa
         .addOption(new Option('--profile-id <profile>', 'existing Pro profile').choices(['F1', 'D1', 'D2']).makeOptionMandatory())
         .requiredOption('--idempotency-key <uuid>', 'persist this UUID4 and original generation; no automatic retry')
         .action(async (id, options) => emit(await (await client()).minds.resize(id, Number(options.expectedGeneration), options.profileId, { idempotencyKey: options.idempotencyKey })));
+    minds.command('profiles').description('List the Mind instance profiles (F1/D1/D2), the plans and environments each is offered in, and whether a change restarts the Mind')
+        .action(async () => emit(await (await client()).minds.profiles()));
+    const scaling = minds.command('scaling').description('Per-Mind scaling policy: idle window and scale to zero (sizes stay on resize); setting needs an org API key with minds:manage');
+    scaling.command('get <mind_id>').description('Read the stored policy (or the effective default, generation 0) and the current scaling state')
+        .action(async (id) => emit(await (await client()).minds.scaling.get(id)));
+    scaling.command('set <mind_id>').description('Set the policy from a JSON file; 409 SCALING_GENERATION_CONFLICT means it changed since you read it')
+        .requiredOption('--generation <number>', 'the stored policy generation from scaling get (0 when none is stored)')
+        .requiredOption('--file <path>', 'JSON policy {vertical, horizontal, idle}, at most 8 KiB')
+        .option('--idempotency-key <uuid>', 'optional UUID4 sent as Idempotency-Key')
+        .action(async (id, options) => {
+        if (!/^(?:0|[1-9][0-9]{0,15})$/.test(options.generation))
+            throw new Error('--generation must be a non-negative integer.');
+        const metadata = await stat(options.file);
+        if (!metadata.isFile() || metadata.size > 8192)
+            throw new Error('Policy file must be at most 8 KiB.');
+        const bytes = await readFile(options.file);
+        if (bytes.length > 8192)
+            throw new Error('Policy file exceeds 8 KiB.');
+        let policy;
+        try {
+            policy = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+        }
+        catch {
+            throw new Error('Policy file must contain valid JSON.');
+        }
+        if (!policy || typeof policy !== 'object' || Array.isArray(policy))
+            throw new Error('Policy file must contain a JSON object.');
+        emit(await (await client()).minds.scaling.set(id, { generation: Number(options.generation), policy }, options.idempotencyKey === undefined ? {} : { idempotencyKey: options.idempotencyKey }));
+    });
+    scaling.command('events <mind_id>').description('List scaling decisions (policy sets, idle stops, wakes, resizes), newest first')
+        .option('--cursor <cursor>', 'next_cursor from the previous page')
+        .option('--limit <number>', '1–100 events (default 50)')
+        .action(async (id, options) => emit(await (await client()).minds.scaling.events(id, { ...(options.cursor === undefined ? {} : { cursor: options.cursor }), ...(options.limit === undefined ? {} : { limit: Number(options.limit) }) })));
     const deliveries = minds.command('webhook-deliveries').description('Durable webhook receipts for an owned Mind; a stopped-idle Mind is woken');
     deliveries.command('create <mind_id>').description('Record one delivery; replay the same delivery_id and body to read the original receipt')
         .requiredOption('--delivery-id <uuid>', 'caller-chosen non-nil UUID; retain it after an uncertain response')

package/dist/products.js

@@ -8,7 +8,8 @@ import { readFunctionJson } from './function-input.js';
 export const PRODUCT_COMMANDS = {
     rigs: { description: 'Rigs: your desktops (One account login or org API key with a selected project)', commands: { list: 'rigs_listRigs', get: 'rigs_getRig', create: 'rigs_createRig', delete: 'rigs_deleteRig', action: 'rigs_actOnRig', term: 'rigs_openRigTerm' } },
     panes: { description: 'Panes: your browsers (One account login or org API key with a selected project)', commands: { list: 'panes_listPanes', get: 'panes_getPane', create: 'panes_createPane', delete: 'panes_deletePane', action: 'panes_actOnPane', term: 'panes_openPaneTerm', screenshot: 'panes_getPaneScreenshotData' } },
-    shells: { description: 'Shells: your sandboxes (One account login or org API key with a selected project)', commands: { list: 'shells_listShells', get: 'shells_getShell', create: 'shells_createShell', delete: 'shells_deleteShell', action: 'shells_actOnShell', term: 'shells_openShellTerm', exec: 'shells_execShell' } },
+    shells: { description: 'Shells: your sandboxes (One account login or org API key with a selected project)', commands: { list: 'shells_listShells', get: 'shells_getShell', create: 'shells_createShell', delete: 'shells_deleteShell', action: 'shells_actOnShell', term: 'shells_openShellTerm', exec: 'shells_execShell',
+            egress: 'shells_getShellEgress', 'egress-log': 'shells_getShellEgressLog', 'egress-request': 'shells_requestShellEgress', 'egress-status': 'shells_getShellEgressRequest', 'egress-revoke': 'shells_revokeShellEgress' } },
     gateway: { description: 'Genesis gateway: status, the verified caller, usage, the error catalog and the served OpenAPI document (answered by the gateway itself)', commands: {
             status: 'gateway_getStatus', whoami: 'gateway_whoami', usage: 'gateway_getUsage', errors: 'gateway_listErrors', openapi: 'gateway_getOpenApi',
         } },
@@ -32,12 +33,14 @@ export const PRODUCT_COMMANDS = {
             'formation-jobs steps': 'orgs_list_formation_steps', 'formation-jobs cancel': 'orgs_cancel_formation_job',
             'record list': 'orgs_get_record', 'record verify': 'orgs_verify_record',
         } },
-    billing: { description: 'Your organization billing: account, contacts, tax IDs, quotas, Minds account, invoices, usage report and the service catalog (login session, or an org API key with genesis.billing.read / .manage / genesis.usage.read). Nothing here pays or charges.', commands: {
+    billing: { description: 'Your organization billing: account, contacts, tax IDs, quotas, Minds account, invoices, usage report, the service catalog and OneOS Pro pricing (pricing and the catalog are public; the rest take a login session, or an org API key with genesis.billing.read / .manage / genesis.usage.read). Nothing here pays or charges.', commands: {
             'account get': 'gateway_getBillingAccount', 'account update': 'gateway_updateBillingAccount', 'account activity': 'gateway_listBillingActivity',
             'contacts list': 'gateway_listBillingContacts', 'contacts create': 'gateway_createBillingContact', 'contacts delete': 'gateway_deleteBillingContact',
             'tax-ids list': 'gateway_listBillingTaxIds', 'tax-ids create': 'gateway_createBillingTaxId', 'tax-ids delete': 'gateway_deleteBillingTaxId',
+            'subscription get': 'gateway_getGenesisProSubscription', 'subscription create': 'gateway_createGenesisProSubscription',
+            'card setup': 'gateway_createBillingCardSetupSession', 'card default': 'gateway_setBillingDefaultPaymentMethod',
             'quotas get': 'gateway_getOrgQuotas', 'quotas requests list': 'gateway_listQuotaRequests', 'quotas requests create': 'gateway_createQuotaRequest',
-            'minds-account': 'gateway_getMindsAccount', invoices: 'gateway_listOrgInvoices', 'usage-report': 'gateway_getOrgUsageReport', catalog: 'gateway_listBillingServices',
+            'minds-account': 'gateway_getMindsAccount', invoices: 'gateway_listOrgInvoices', 'usage-report': 'gateway_getOrgUsageReport', catalog: 'gateway_listBillingServices', pricing: 'gateway_getBillingPricing',
         } },
     credits: { description: 'Your One credits: balance, catalog, ledger, usage, settings, checkout, wallet payment and subscription (login session, or an org API key with genesis.billing.read / .manage). Stripe test mode: checkout opens checkout.stripe.com and nothing is charged until you pay there.', commands: {
             balance: 'gateway_getCredits', catalog: 'gateway_getCreditCatalog', entries: 'gateway_listCreditEntries', usage: 'gateway_listCreditUsage', settings: 'gateway_updateCreditSettings',
@@ -238,6 +241,10 @@ export const PRODUCT_COMMANDS = {
             'lineage challenge': 'taps_createAgentLineageChallenge', 'lineage requests create': 'taps_createAgentLineageRequest',
             'lineage requests list': 'taps_listAgentLineageRequests', 'lineage requests get': 'taps_getAgentLineageRequest',
         } },
+    one: { description: 'One: your own One, read, stop and resume it and manage its wakes (One account login only; never an org API key or an agent)', commands: {
+            'instance get': 'one_getInstance', 'instance stop': 'one_stopInstance', 'instance resume': 'one_resumeInstance',
+            'wakeups list': 'one_listWakeups', 'wakeups create': 'one_createWakeup', 'wakeups cancel': 'one_cancelWakeup',
+        } },
     // `genesis minds engine <family> <verb> <mind_id> [params]`: every Minds engine route, generated from the grant table.
     minds: { description: 'Minds: your Minds in the selected environment (One account login)', commands: mindsEngineCommands },
     boxes: { description: 'Boxes: mail, docs, files, sheets, slides, calendar and identity (org API key; GET boxes:read, writes boxes:write, mail domains boxes:admin)', commands: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesi/genesis-cli",
-  "version": "0.2.13",
+  "version": "0.2.15",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/l1felabs/genesis-api.git",
@@ -21,7 +21,7 @@
     "ai-agents",
     "api"
   ],
-  "author": "One Superintelligence, Inc.",
+  "author": "L1fe AI Inc.",
   "homepage": "https://os.one.ml/docs",
   "engines": {
     "node": ">=20.19"
@@ -33,7 +33,7 @@
   "dependencies": {
     "commander": "^14.0.0",
     "undici": "6.29.0",
-    "@onesi/genesis": "0.2.13"
+    "@onesi/genesis": "0.2.15"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.2.0"